diff --git a/lib/resourcemerge/core.go b/lib/resourcemerge/core.go
index b75d00131..bba463fb6 100644
--- a/lib/resourcemerge/core.go
+++ b/lib/resourcemerge/core.go
@@ -103,23 +103,7 @@ func ensureContainer(modified *bool, existing *corev1.Container, required corev1
 	ensureEnvFromSource(modified, &existing.EnvFrom, required.EnvFrom)
 	setStringIfSet(modified, &existing.WorkingDir, required.WorkingDir)
 	ensureResourceRequirements(modified, &existing.Resources, required.Resources)
-
-	// any port we specify, we require
-	for _, required := range required.Ports {
-		var existingCurr *corev1.ContainerPort
-		for j, curr := range existing.Ports {
-			if curr.Name == required.Name {
-				existingCurr = &existing.Ports[j]
-				break
-			}
-		}
-		if existingCurr == nil {
-			*modified = true
-			existing.Ports = append(existing.Ports, corev1.ContainerPort{})
-			existingCurr = &existing.Ports[len(existing.Ports)-1]
-		}
-		ensureContainerPort(modified, existingCurr, required)
-	}
+	ensureContainerPorts(modified, &existing.Ports, required.Ports)
 
 	// any volume mount we specify, we require
 	for _, required := range required.VolumeMounts {
@@ -195,6 +179,37 @@ func ensureProbeHandler(modified *bool, existing *corev1.Handler, required corev
 	}
 }
 
+func ensureContainerPorts(modified *bool, existing *[]corev1.ContainerPort, required []corev1.ContainerPort) {
+	for i := len(*existing) - 1; i >= 0; i-- {
+		existingContainerPort := &(*existing)[i]
+		var existingCurr *corev1.ContainerPort
+		for _, requiredContainerPort := range required {
+			if existingContainerPort.Name == requiredContainerPort.Name {
+				existingCurr = &(*existing)[i]
+				ensureContainerPort(modified, existingCurr, requiredContainerPort)
+				break
+			}
+		}
+		if existingCurr == nil {
+			*modified = true
+			*existing = append((*existing)[:i], (*existing)[i+1:]...)
+		}
+	}
+	for _, requiredContainerPort := range required {
+		match := false
+		for _, existingContainerPort := range *existing {
+			if existingContainerPort.Name == requiredContainerPort.Name {
+				match = true
+				break
+			}
+		}
+		if !match {
+			*modified = true
+			*existing = append(*existing, requiredContainerPort)
+		}
+	}
+}
+
 func ensureContainerPort(modified *bool, existing *corev1.ContainerPort, required corev1.ContainerPort) {
 	if !equality.Semantic.DeepEqual(required, *existing) {
 		*modified = true
diff --git a/lib/resourcemerge/core_test.go b/lib/resourcemerge/core_test.go
index 4978302af..6cdb74079 100644
--- a/lib/resourcemerge/core_test.go
+++ b/lib/resourcemerge/core_test.go
@@ -246,6 +246,96 @@ func TestEnsurePodSpec(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "add ports on container",
+			existing: corev1.PodSpec{
+				Containers: []corev1.Container{
+					corev1.Container{Name: "test"},
+				},
+			},
+			input: corev1.PodSpec{
+				Containers: []corev1.Container{
+					corev1.Container{
+						Name: "test",
+						Ports: []corev1.ContainerPort{
+							corev1.ContainerPort{ContainerPort: 8080},
+						},
+					},
+				},
+			},
+			expectedModified: true,
+			expected: corev1.PodSpec{
+				Containers: []corev1.Container{
+					corev1.Container{
+						Name: "test",
+						Ports: []corev1.ContainerPort{
+							corev1.ContainerPort{ContainerPort: 8080},
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "replace ports on container",
+			existing: corev1.PodSpec{
+				Containers: []corev1.Container{
+					corev1.Container{
+						Name: "test",
+						Ports: []corev1.ContainerPort{
+							corev1.ContainerPort{ContainerPort: 8080},
+						},
+					},
+				},
+			},
+			input: corev1.PodSpec{
+				Containers: []corev1.Container{
+					corev1.Container{
+						Name: "test",
+						Ports: []corev1.ContainerPort{
+							corev1.ContainerPort{ContainerPort: 9191},
+						},
+					},
+				},
+			},
+			expectedModified: true,
+			expected: corev1.PodSpec{
+				Containers: []corev1.Container{
+					corev1.Container{
+						Name: "test",
+						Ports: []corev1.ContainerPort{
+							corev1.ContainerPort{ContainerPort: 9191},
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "remove container ports",
+			existing: corev1.PodSpec{
+				Containers: []corev1.Container{
+					corev1.Container{
+						Name: "test",
+						Ports: []corev1.ContainerPort{
+							corev1.ContainerPort{ContainerPort: 8080},
+						},
+					},
+				},
+			},
+			input: corev1.PodSpec{
+				Containers: []corev1.Container{
+					corev1.Container{Name: "test"},
+				},
+			},
+			expectedModified: true,
+			expected: corev1.PodSpec{
+				Containers: []corev1.Container{
+					corev1.Container{
+						Name:  "test",
+						Ports: []corev1.ContainerPort{},
+					},
+				},
+			},
+		},
 	}
 
 	for _, test := range tests {